Verify identity before promoting an artifact

What This Concept Is

Promotion selects an already built artifact. Verification compares its bytes and provenance against an independently chosen trust policy. A digest establishes byte identity; a signature connects a statement to a signing identity under a verification system.

Why It Matters Here

The trusted-artifact lab needs to reject the right failures, not just produce an SBOM and a signature file.

Concrete Example

Release A was reviewed at digest D. A tag later points to E. Deploying the tag breaks the evidence chain even if both images are signed. Verify the artifact digest, expected source revision, builder identity and relevant build inputs under the chosen policy. A signed artifact from an unexpected builder must fail that policy.

Common Confusion / Misconception

Signing does not prove vulnerability freedom or correct source. An SBOM is an inventory, not a pass certificate. A manifest whose digest is supplied by the same untrusted input is not an independent expectation.

How To Use It

Record the expected identity separately, then test changed bytes, wrong builder, wrong source, missing signature and valid artifact. Preserve the deployed digest and verification result. Do not publish private credentials or raw sensitive provenance.

Check Yourself

Who chooses the trusted builder? What if the signature is valid but the source differs? Can rebuild-on-promotion preserve the original evidence?

Mini Drill or Application

Take the original pipeline artifact and mutate one byte in a disposable copy. Show the trusted verifier rejects it while the unmodified artifact succeeds.

Read This Only If Stuck

Building Secure and Reliable Systems provides selective operational reasoning. Use the module sources below for current tool behavior; do not read a whole book before attempting the exercise.

SLSA v1.2 verification; Google SRE canarying; DORA metric definitions.